note 77875 added to function.is-uploaded-file

The description in the manual above says that the function needs an argument like: <?php $_FILES['userfile']['tmp_name'] ?> Which is incorrect! This variable returns the pathname of the temp file (with random filename) that is created by php and, besides, is a superglobal so there is no way that it is overridden to point to another file (by injection when register_globals is on for example). Which means that: <?php is_uploaded_file($_FILES['userfile']['tmp_name']); ?> MUST always evaluate to true by definition which is, of course, useless. The function is to be used only with variables that are prone to injection, which should not happen anyway since everyone should have their register globals off (finally we get rid of that in PHP6). Only $_FILES['userfile']['name'] contains user submitted string and should be sanitized if it's to be used as a filename because it could (could it?) contain relative or absolute path or undesirable filename. The former is done simply with: <?php $filename = basename($_FILES['userfile']['name']); ?> ---- Server IP: 217.75.128.29 Probable Submitter: 84.22.27.213 ---- Manual Page -- http://www.php.net/manual/en/function.is-uploaded-file.php Edit -- https://master.php.net/note/edit/77875 Del: integrated -- https://master.php.net/note/delete/77875/integrated Del: useless -- https://master.php.net/note/delete/77875/useless Del: bad code -- https://master.php.net/note/delete/77875/bad+code Del: spam -- https://master.php.net/note/delete/77875/spam Del: non-english -- https://master.php.net/note/delete/77875/non-english Del: in docs -- https://master.php.net/note/delete/77875/in+docs Del: other reasons-- https://master.php.net/note/delete/77875 Reject -- https://master.php.net/note/reject/77875 Search -- https://master.php.net/manage/user-notes.php